- Being resilient to cyberattacks
and cyberfailures is one of the four major goals
of an information security program.
Without enough resilience,
a cyberattack or failure could result in damage
severe enough that a company could be greatly hurt
or even go out of business.
Let's review a few high profile cases
to get a feel for what's at risk.
Code Spaces was a software sourcecode hosting
and software collaboration platform
with over 200 business customers.
In 2014, it was put out of business within 12 hours
by a cyberattacker who deleted all their data and backups.
The attacker broke into Code Spaces'
Amazon EC2 control panel and left extortion demands.
When the attackers saw signs
that Code Spaces was fighting back,
they deleted the data,
putting the cost of recovery out of reach.
In March 2019, Oslo based Norsk Hydro experienced
a crippling ransomware attack
that shut down all their aluminum production.
All their computer systems had been encrypted
by malicious code and held for ransom.
The attack forced Hydro to return to pen and paper
for its record keeping for more than a week.
They eventually restarted operations
and soon after reported an 82% drop
in first quarter profit.
And then, they suffered a 20% decrease
in the price of their publicly traded stock.
In 2012, malware partially wiped or totally destroyed
the hard drives of 35,000 Saudi Aramco computers.
Just like at Hydro, employees used pens, typewriters,
and fax machines to run the massive company
that handles 10% of the global oil supply.
It took the rapid purchase of 50,000 new hard drives
and five months of hard work,
but Saudi Aramco eventually came back online.
In another case in November 2014,
a hacker group which identified itself by the name,
Guardians of Peace, leaked a large amount
of Sony Pictures confidential data.
The data included personal information about employees
and their families, emails between employees,
information about executives' salaries,
copies of yet unreleased Sony films,
and other sensitive information.
It took over six weeks to achieve the initial recovery
and total costs may top over $100 million.
The studio resorted to fax machines
and paying its 7,000 employees with paper checks.
Shortly after the data breach, the CEO resigned,
which can be another major consequence
of large cyberfailures.
In March of 2017, over 147 million credit records
were stolen from the American credit bureau, Equifax.
Shortly thereafter, a new CIO and then a new CEO
joined the company.
Recovery costs hit $1.4 billion as of May 2019,
and settlements with US regulators in late 2019
will require Equifax to spend over a billion dollars more
on cybersecurity over the next five years.
In April 2016, a German newspaper announced
that 12.7 million confidential documents
from the Columbian law firm, Mossack Fonseca,
had been leaked to them by an anonymous source.
The Panama Papers show how the firm's clients
hid billions of dollars to avoid paying taxes.
Vice.com called Mossack Fonseca the law firm that works with
"oligarchs, money launderers, and dictators."
The final case we'll look at involves damages
at a national level.
The Natanz uranium enrichment plant in Iran
was attacked by a malicious piece of code called Stuxnet.
Publicly revealed in 2010, Stuxnet sabotaged uranium gas
enrichment centrifuges by silently manipulating valves
to damage the devices as well as the enrichment process.
It also sent fake data to the system's monitors
showing all was well.
Many credit this cyberattack with helping to bring
the Iranians to the nuclear arms control negotiating table.
I want to wrap up this video with a couple of thoughts
about the insidious nature of integrity attacks.
Think about the power of Stuxnet
and imagine the potential damage a data integrity attack
could have against a hospital.
By relying on inaccurate medical records,
a doctor might prescribe the wrong drug
or administer a dose that's too large or too small.
Without accurate monitors on medical equipment,
a patient could get an overdose of radiation.
What about an integrity attack against the stock market,
a major bank, or our electrical grid?
Helping your organization be resilient
in the face of cyberattacks and failures
will become even more crucial in the future.